Hi everyone,
I need you'r help - I have been struggling with configuration for a long time.
On a virtual server (VM) I installed openvpn and I added a vlan interface (eth0.100) for internal systems with IP: 10.2.6.10/8
Problem is where I try ping one of server from vlan 100 with ip: 10.2.6.100 on client computer connected to OpenVPN (ip: 10.10.6.130)
in tcpdump I see that traffic are correctly incoming and his move to vlan interface (eth0.100) and server get ICMP request and he gives it back (icmp replay) but VM with OpenVPN can not transfer it to the computer..
Some information:
- OpenVPN Server IP: 10.2.6.10/8 - interface: eth0.100 (vlan) with CentOS 7.5
- Some Server on vlan.100 IP: 10.2.6.100 - interface: eth0
- Client Computer connected to OpenVPN Server - IP: 10.10.6.130
- tcpdump on VM with OpenVPN
[najkon@vpn 12:21 ~]$ tcpdump -e -i any icmp and net 10.0.0.0/8
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:21:38.928522 In ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1369, length 64
12:21:38.928554 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1369, length 64
12:21:38.928558 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype 802.1Q (0x8100), length 104: vlan 100, p 0, ethertype IPv4, 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1369, length 64
12:21:39.984598 In ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1370, length 64
12:21:39.984633 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1370, length 64
12:21:39.984637 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype 802.1Q (0x8100), length 104: vlan 100, p 0, ethertype IPv4, 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1370, length 64
12:21:40.992508 In ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1371, length 64
12:21:40.992540 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype IPv4 (0x0800), length 100: 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1371, length 64
12:21:40.992543 Out aa:c1:f4:c0:2d:ed (oui Unknown) ethertype 802.1Q (0x8100), length 104: vlan 100, p 0, ethertype IPv4, 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1371, length 64
- tcpdump on server: 10.2.6.100
[najkon@vm-100 12:21 ~]$ tcpdump icmp and net 10.0.0.0/8
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:22:01.931267 IP 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1388, length 64
12:22:01.931313 IP 10.2.6.100 > 10.10.6.130: ICMP echo reply, id 20, seq 1388, length 64
12:22:02.932465 IP 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1389, length 64
12:22:02.932491 IP 10.2.6.100 > 10.10.6.130: ICMP echo reply, id 20, seq 1389, length 64
12:22:03.936681 IP 10.10.6.130 > 10.2.6.100: ICMP echo request, id 20, seq 1390, length 64
12:22:03.936706 IP 10.2.6.100 > 10.10.6.130: ICMP echo reply, id 20, seq 1390, length 64
My iptables config
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
26360 1997K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
52875 2644K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
1599K 121M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
332 13476 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL
83139 5591K ACCEPT all -- * * 10.0.0.0/8 0.0.0.0/0
83730 9386K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
726 60984 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 4374 packets, 356K bytes)
pkts bytes target prot opt in out source destination
[najkon@vpn 13:03 ~]$ iptables -L -n -v -t nat
Chain PREROUTING (policy ACCEPT 6185K packets, 315M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 164K packets, 12M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 26726 packets, 1607K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 26734 packets, 1608K bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- * * 10.10.6.130/24 !10.0.0.0/8 to:$PUB_IP
- Routes
[najkon@vpn 12:31 ~]$ ip r
default via $PUB_IP dev eth0
10.0.0.0/8 dev eth0.100 proto kernel scope link src 10.2.6.10
10.10.6.0/24 dev tun0 proto kernel scope link src 10.10.6.1
$PUB_IP/xx dev eth0 proto kernel scope link src $PUB_IP
- sysctl -a
net.ipv4.ip_forward = 1
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0/100.arp_filter = 0
net.ipv4.conf.eth0/100.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.tun0.arp_filter = 0
net.ipv4.conf.tun0.rp_filter = 0
I tried to manipulate
rp_filter between 1 and 2 unfortunately without effect.
..and Yes, I don't want to hide computers (MASQUERADE)
